CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

EUVD-2026-92074

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin (versions 2.3.20-2.3.21 ) is vulnerable to a sensitive data disclosure flaw. The issue stems from the plugin failing to properly restrict callbacks used to resolve schema field default values. This allows authenticated users with Author-l...

CVE-2026-86817 Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

PT-2026-104609

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

CVE-2026-86817: Undefined Security Weakness

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

EUVD-2026-68402

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

PT-2026-83744

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

Cross-site Scripting (XSS)

Overview @dicebear/initials is an Initials avatar style for DiceBear Affected versions of this package are vulnerable to Cross-site Scripting XSS via unescaped interpolation of the rotate, fontSize, and fontWeight option values into SVG attributes. While other attribute values were properly...

CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

CVE-2026-71243

The CVE-2026-71243 entry concerns the backmeup npm package. It vulnerably assembles shell command strings by concatenating option values (name, source, destination, filter) into a single command (e.g., mkdir -p ...; ) and executes via a shell (ssh2-exec or local child_process), instead of using a...

CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

Oracle Linux 10 : cups (ELSA-2026-39302)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39302 advisory. 1:2.4.10-18 - RHEL-177945 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly fro...

Oracle Linux 9 : cups (ELSA-2026-39316)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39316 advisory. 1:2.3.3op2-39 - RHEL-177957 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly fr...

cups security update

1:2.3.3op2-39 - RHEL-177957 CVE-2026-34980 cups: control character injection in option values...

Oracle Linux 8 : cups (ELSA-2026-36733)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36733 advisory. 1:2.2.6-68 - RHEL-177947 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly from...

cups security update

1:2.2.6-68 - RHEL-177947 CVE-2026-34980 cups: control character injection in option values...

CVE-2026-5109

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted...

CVE-2026-5109

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted...